[Resolved] Trouble removing stubborn infections

I am having the same issue as before, even though i scan and quickly go to the folder, the files aren't there at all. I do have hidden files and folders as i can clearly see in both the Jotti browse for file window and my explorer window the system volume info, config.sys and autoexec.bat on my c:\

Have you noticed any degradation in the performance of your system? I have not received any results on those two files yet but strongly suspect malware due to the fact that they are always changing names (which also complicates their removal). If, we do not get a response by tomorrow, I will suggest that we remove them. and observe the performance of your system, specially the security programs. Backups of these files, if removable, will exist in case they must be removed. Sound like a sound plan to you? Trev

I had been riddled with a lot of malware for a while, the fixes throughout the thread have much improved my performance (much thanks for the help~) so it is difficult to say if those files are causing trouble as I have only a worse system to compare to. I cannot find the files at all when browsing to the respective folder. I have been trying to remove them with AVG Root-kit Free since before posting on these forums, so that is not an option. I could do it every time i boot up i guess and tel it not to delete? AVG asks for a restart and displays the delete confirmation after the restart so it might not work Alright, I figured if my machine has caught something (and is still infected by it) it cant catch it again. I extracted the submit compressed file that was made earlier (Im a packrat, trouble deleting things :x) and looked at their properties. They read their a Microsoft IDE/Atapi driver, original filename (under properties) atapi.sys. Asuming Combofix caught the correct files that would be it. I still cannot find any of the things found by AVG in the folder it specifies (c:\windows\system32\drivers\) edit: added "(and is still infected by it)" edit: Yes, I'm willing to do anything withing my abilities short of formatting my HD

Well if that is what you were able to find out about those files then they are not malware but randomly generated files that appear upon boot up. That is what the expert that I consulted was thinking that is why we did not remove them, just used the "Suspect" command. I would leave them alone as to not risk damaging your system and you try to leave the Anti Rootkit program tucked away and stop looking every day. If all seems well, give me the OK and later this afternoon, we will proceed with the final cleanup procedures. Trevuren

Hehe, alright sounds good.

A. Please make sure that all your security programs are enabled once again.


B. Congratulations, your logs look CLEAN

There are a few things you must do once you system is completely clean:

Time for some housekeeping

• Click START then RUN
• Now type Combofix /u in the runbox and click OK
  
  
  
• [external image: Posted Image]

The above procedure will:

• Delete the following:
  • ComboFix and its associated files and folders.
  • VundoFix backups, if present
  • The C:\Deckard folder, if present
  • The C:_OtMoveIt folder, if present
• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Reset System Restore.

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer More Secure

• From within Internet Explorer click on the Tools menu and then click on Options.
• Click once on the Security tab.
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
  
  
  • Change the Download signed ActiveX controls to Prompt.
  • Change the Download unsigned ActiveX controls to Disable.
  • Change the Initialise and script ActiveX controls not marked as safe to Disable.
  • Change the Installation of desktop items to Prompt.
  • Change the Launching programs and files in an IFRAME to Prompt.
  • Change the Navigate sub-frames across different domains to Prompt.
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
• Next press the Apply button and then the OK to exit the Internet Properties page.

2. Use and Update an Anti-Virus Software - I can not overemphasize the need for you to use and update your Anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

3. FIREWALL
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here

Do not install more than one firewall program because they will conflict with each other


4. Make sure you keep your Windows OS current by visiting Windows update regularly to download and install any critical updates and service packs. Without these you are leaving the back door open.

5. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

6. Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

7. Install Spybot - Search and Destroy - Download and install Spybot - Search and Destroy with its TeaTimer option. This will provide real time spyware and hijacker protection on your computer alongside your virus protection. You should scan your computer with the program on a regular basis just as you would with your anti-virus software. A tutorial on installing and using this product can be found here:
Instructions for - Spybot S & D and Ad-aware

8. Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?

Alright I have done as instructed. Much thanks for all your help Trevuren, and sorry for the complication regarding the rootkits. I am in the process of getting the recommended software.

BIG THANKS again

It was my pleasure and no need for:

sorry for the complication regarding the rootkits

That was way more interesting than cleaning 20 consecutive machines full of Vundo.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.